LearnHouse Missing Authorization in Assignment API Vulnerability (CVE-2026-120199) Analysis & Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTLearnHouse versions prior to 1.1.1
Authenticated users can exploit missing authorization checks to read other users' grades, submissions, and instructor feedback
Immediately upgrade LearnHouse to version 1.1.1 or higher and enforce strict API access control policies
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To remediate this vulnerability, upgrade your LearnHouse deployment to version 1.1.1 or later, which contains the official authorization fixes. If you are running LearnHouse via Docker Compose, use the following commands:
# Navigate to the LearnHouse directory
cd /path/to/learnhouse
# Update the image tag to 1.1.1 in your docker-compose.yml file
sed -i 's/:1.1.0/:1.1.1/g' docker-compose.yml
# Rebuild and restart the containers
docker-compose down
docker-compose up -d --build2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, you can implement temporary request filtering at the reverse proxy level (e.g., Nginx) to monitor or restrict access to the vulnerable endpoints.
# Nginx configuration to log and inspect suspicious assignment API requests
location ~* /api/v1/courses/activities/assignments/.*/submissions {
# Log requests for further inspection of user_id parameters
access_log /var/log/nginx/suspicious_api_access.log;
proxy_pass http://learnhouse_backend;
}3. Log Audit & IoC Verification Commands
You can inspect the API container logs to identify potential exploitation attempts where multiple distinct user_id parameters are requested by a single session or IP address.
# Extract and count unique user_id queries to the assignment submissions endpoint
docker logs learnhouse-api-1 2>&1 | grep -E '/assignments/.*(submissions|grade)' | awk -F'?' '{print $2}' | grep -o 'user_id=[^&]*' | sort | uniq -cBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-120199) is a missing authorization flaw in the assignment API endpoints of LearnHouse, an open-source education platform. Specifically, it is a classic Insecure Direct Object Reference (IDOR, CWE-639) vulnerability resulting from a failure to validate ownership of user-controlled input parameters. The API server processes requests without verifying whether the authenticated user session matches the target user_id supplied in the request payload or query parameters.
2. Exploitation Mechanics & Attack Scenario
An attacker with a valid student account (authenticated user) can initiate the exploit. By intercepting and modifying API requests to the submissions grade endpoint or query submission read functions, the attacker replaces their own user_id with another student's user_id. Because the backend (apps/api/src/services/courses/activities/assignments.py) lacks proper server-side authorization checks to ensure the requester has permission to access the target resource, it processes the request and returns the victim's private data, including grades, submitted work, and instructor feedback.
3. Infrastructure & Business Impact
In educational environments, student submissions and grades constitute highly sensitive personal and academic data. Exploitation of this vulnerability can lead to widespread privacy violations, academic integrity issues, and loss of trust in the platform. Furthermore, automated scripts could be used to scrape the entire database of student submissions, leading to severe data breach compliance issues and reputational damage.
Official Vendor Advisories & References
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.
Frequently Asked SecOps Questions (CVE-2026-120199)
FAQQ1. How critical is CVE-2026-120199 and is it actively exploited in the wild?
CVE-2026-120199 is rated CVSS 4.3 (MEDIUM) with a 30-day EPSS exploitation probability of 0.2%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120199?
Primary impacted vendors include learnhouse across learnhouse. Scope summary: All LearnHouse versions prior to 1.1.1 (including version 1.1.0 and earlier)
Q3. What temporary mitigations or workarounds exist for CVE-2026-120199 before patching?
[Mitigation] Immediately upgrade LearnHouse to version 1.1.1 or higher and enforce strict API access control policies Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120199
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (learnhouse)
View Category →Langflow /api/v1/responses IDOR Vulnerability Leading to Unauthorized Flow Execution (CVE-2026-55255)
[Affected Scope] Langflow versions prior to 1.9.1
IXP Manager IDOR Vulnerability in API Key Management (CVE-2026-63338)
[Affected Scope] All IXP Manager installations prior to version 7.3.0.
Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes (CVE-2026-120200)
[Affected Scope] All deployments running Nexterm through version 1.2.2-BETA
YITH WooCommerce Product Add-Ons Unauthenticated Bypass Vulnerability (CVE-2026-107868)
[Affected Scope] YITH WooCommerce Product Add-Ons plugin versions 4.34.0 and below.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.